The learning journey of Samuel Medeiros
Dev · Projects · Studies · Discoveries
79 tests green one day, 4 failing the next, zero production changes. Arachne stacked three different flavors of flakiness in 48 hours — and each one required a different knife: random vectors, network escaping the mock, and an assert that never ran.
The post was hidden, its route returned 404, the feed didn't mention it. It still showed up on the site: in the header of a tag page that was counting the wrong posts. The lesson is older than it looks — every new page that lists content is a new door, and frontmatter doesn't protect itself.
A test was deleting RAG tables on teardown. One run, the environment variable pointing at the isolated database was ignored by the engine — and the DELETE landed on the production arachne.db, with the live server writing to it. What saved the data was an error message.
A catatonic BitMamba 1B — broken tokenizer, 10^18 gradients, a midnight ENOMEM and a CUDA wedge that faked a dead GPU — closed 500 steps and the validation reproduced the eval loss to the fourth decimal. The diary of Phase 4B on a 12 GB RTX 3060.
PataPass was a website wearing an app costume — and the browser made that obvious at the worst possible moment: inside an elevator with no signal. The story of Phase 4F: an install banner driven by beforeinstallprompt, an offline page served by the service worker, and the decision to never cache HTML.
The cover was remade twice, the deployment served the new bytes — and the blog kept showing the old image. The culprit wasn't the build or the CDN: it was a header promising the file would never change for a year. The story of the hunt, the math of immutable caching, and the rule that stuck: reworking an asset requires a new URL.
The Capivara light theme had washed-out text and a truncated email in the header. Static scanners stayed green, because none of them can see pixels. The one that caught it was a vision AI running screenshots of the real dashboard — and the patch was swapping hardcoded values for theme tokens and giving the layout room to breathe.
I resumed a run from the last checkpoint and it looked healthy — steps advancing, gradient in range, zero errors. Except the learning rate had quietly shrunk by three orders of magnitude. The cause: the LR scheduler restores more than it should when loading old state, and the fix was two lines.
React hydration error #418 in the portfolio footer, a mystery that only happened at night: the server renders in UTC, the visitor in local time, and a new Date() in JSX gave each of them a different answer. The hunt for the useState(null), the pinned timeZone, and the epilogue where I myself created a second bug while fixing the first.
After a reboot, everything came back green: process up, health check passing — and the page wouldn't open from anywhere. The service had resurrected with instructions from a past life, frozen in a state file, while the world outside had moved. This post covers the hunt, the fix at the source (stale state dies on every start, address defined in exactly one place) and the second half of the story: a network announcement that only talked to an interface with a fixed name, on the day the system renamed it.
On August 11 I put a secret scanner on this blog's pipeline. The next day it flagged a build cache file as if it were a key. I silenced it with an entry pinned to that finding's exact fingerprint. Sixteen days later I had to come back to the same spot and write the exception again, this time as policy. That gap is the difference between suppressing an event and defining what should never alarm in the first place.
The status button finally worked within the session — but an F5 wiped it all: a reload brought the walker back offline for the entire system. The direct sequel to the ghost button: real persistence of the online status, from the frontend down to the profile PATCH.
The Arachne landing page loaded without CSS, the watchdog restarted the service in an invisible loop, and a zombie socat relay kept stealing the port from its rightful owner. Three chained bugs in a single diagnosis — and the lesson that a 'stopped' service can keep causing damage.
The new stage in my transcription pipeline uses Gemini TEXT over 120s windows — no audio, cheap and fast. What keeps the model from making things up isn't a polite prompt: it's a numeric ±35% character invariant per window, with retry and flag when the math doesn't close.
After the bilingual jump to 0.1614 recall@1, there was a number left on the bench: how much was the cross-encoder contributing on every search? The week I measured that latency and recall are a bill you pay on every query — and the answer ended up written as a permanent flag in the config.
Gitleaks, bandit and opengrep ran weekly and everything stayed green. Even so, a single GET request returned the entire .env in production. The hole wasn't a committed secret — it was a path my own code opened. And the one who found it wasn't the scanner.
The Phase 4 run dropped mid-flight with no traceback, no OOM, no error log: the process simply stopped existing. Chasing the cause turned into a lesson about watching the wrong metrics — and about the invisible cost of letting your GPU driver sweep up your garbage.
The alarm hunts, the gate blocks, the dog attacks. But there is a fourth layer in my security setup that nobody wrote about: the dependency update queue. On August 31st, the bot delivered five fix proposals. Three days later, all five are still open. The queue became the surface.
The portfolio hero typed, erased, and retyped — not as an effect, but as a bug: deferred hydration mounted the component and reset the text already on screen. The story of how LCP dropped from 3.6s to 2.7s by removing idle-hydration from the wrong place.
The walker toggle 'Go Online' rendered, animated, and even changed color. But the handler was an empty function: the state never left 'online'. The story of how a test loop caught a ghost button and gave back real online status.
300 training steps, a loss stuck at 10.8125, and a model that insisted on coming out blank. The cause wasn't a low learning rate — it was exploded weights in the starting checkpoint. The story of how a stalled run became a full diagnosis.
Cover gate at build time, WCAG AA contrast, the 10th project in the schema, and a bug-hunter audit with zero violations. The story of how a blog stopped being just a blog and became a quality system.
A brand-new CRUD in the personal hub, with groups, priorities and status — and a silent bug: the apiFetch helper already prepends /api, and I called /api/pedidos on top of it. /api/api/pedidos was born, and nobody saw it.
A study about cron jobs: why they accumulate, fail silently, and how a cron that 'never sleeps' can take down an ecosystem. From Yurumi's consolidation to 289 orphan jobs — the lessons from a night of investigation.
Yurumi started as a local replacement for mem0 — storing conversation memories. In two weeks it gained intent, actions, learning, its own identity and a knowledge graph. The journey from a simple store to a complete agentic system.
The codec post ended with a dangling issue: the lm_head diverging in validation. Two weeks later, a methodical audit rescaled the model's head, generated a clean checkpoint, and became the foundation of Phase 4 — the Resurrection.
Ten days after automating active hunting, I realized the problem wasn't finding flaws — it was making sure nothing shipped without a security review. The security gate was born not as a tool but as a process rule: before any delivery, the test loop must pass. And the loop includes a dedicated security reviewer.
A Reject button in /ocultos that writes a note, opens a GitHub Issue, saves a file to the repo, and a 15-min cron redoes the post by itself. The story of how human feedback became a pipeline.
Three embedding models, two search systems, one homegrown benchmark: the study that started with a question about semantic similarity and ended up revealing the tradeoffs between colibri, bge and openai — and how each one found its place in the ecosystem.
Capivara kept its memories in a local ChromaDB, with its own embedder and L1-L4 layers. Yurumi kept the ecosystem's memory in a Qdrant. Two separate memories meant a brain that never talked to the rest of the body. The unification on 08/28 migrated 182/182 memories without losing a single one: hash dedup, backup before deleting, and an --apply gate that separates the plan from the execution.
Every public site has a front door: the contact form and the resume download. Two endpoints that accept input from strangers on the internet — and I finally treated them as such. Rate limiting, HTML escaping, a contact file for people who find flaws, and a scanner that watches everything in silence.
The home dashboard used to load section by section, and I still had to assemble the big picture in my head. Enter the Executive Hub: one endpoint aggregating projects, backups, alerts and infra in a single call, with graceful failure and zero SSRF.
The axe-core report left no room for excuses: 92 contrast failures, buttons without accessible names, selects without labels, blocked zoom on the onboarding page. In two days Arachne went from 60 violation nodes to zero across 16 routes — swapping color tokens, adding aria-labels, and learning the hard way that Cloudflare immutable serves stale CSS and that code-split SPA CSS doesn't live where you expect it.
Every project's AGENTS.md was the official instruction set of the ecosystem, but it lived outside the Yurumi's memory — the ingest only ran when someone remembered to run it. The fix was a signature watcher (mtime+size) that re-ingests only what changed. Along the way: a first_run that ran a full ingest every day, an os.stat that hung when WSL wedged, and the lesson of never trusting a junction.
When the theme toggle animation revealed the old theme instead of the new one, the fault was not in the CSS — React had not committed the state in time.
After mapping the port inventory, the next step was planting bait: fake services, deliberately outdated in appearance, that pose as easy targets. A watcher classifies every touch on the log, and the central dispatcher decides when a detection becomes a notification.
An accessibility audit on LifeLog turned into a hunt for four contrast traps: code comments at 3.9:1, project badges failing in 4 of 6 palettes, a theme selector that Astro scoping silently broke, and the alpha that axe-core refuses to compose. The result: 14 routes x themes with zero serious/critical violations.
The simple question 'what does my agent actually remember?' turned into a full audit of Yurumi: 32 knowledge bases, 551 documents, a Qdrant collection with over 8 thousand vectors, and a LoCoMo baseline that handed back reality in percentage form.
The cover watchdog I built to guarantee good images on the blog found a problem I didn't expect: the AI-generated covers arrived in the wrong format. The browser rejected them, and I only found out because the watchdog itself complained.
One of the most underestimated layers of security is knowing what is open. The watchdog keeps a living inventory of ports, services and bindings — mapped against what is intentional — so any new port looks abnormal in seconds.
I actually read the BitNet b1.58 paper and got stuck on a math problem that refused to add up: how do three values (-1, 0, +1) fit in 1.58 bits? A study week that became a didactic clone of ternary quantization — and wrecked my mental model of 'precision equals quality'.
A repo that accumulates build artifacts and syncs doesn't tell the clean story you want to show. TatuEngine went through versioning hygiene: build artifacts out of git, auto-sync running, and a repository ready for outsiders to look at without handing over the internal recipe.
The second brain got a brand-new theming system: a ThemeProvider with design tokens, CSP-compliant anti-flash, and per-project palettes. Along the way, the email service quietly broke because the Resend domain was wrong — and invites started arriving again.
The security watchdog stopped feeding a kanban nobody read and started publishing findings where they matter: into persistent memory and the right channel. Less ceremony, more active hunting, zero cards.
Four commits in a row touching the LifeLog navbar, each one undoing the effect of the one before it. Links that disappeared, a logo that jumped away, a button that floated on its own. The lesson: refactoring in a hurry across a jumble of classes is like baking a cake while changing the recipe at every step.
Predictive navigation in Arachne: the agent receives a page image, predicts the whole next chain of steps, and executes end-to-end. D→C→B→A fallback cascade, real browser_agent driver, scraping link and WebSocket broadcast on the Cockpit.
A wrong Cache-Control header in vercel.json was overriding the revalidate=1800 ISR setting and turning every cache expiry into two synchronous GitHub calls inside the TTFB. The story of how cold cache became warm: 3.6s down to 140ms.
After the wave field theory and Mamba post, the theory gained something it was missing: a didactic, portable, testable artifact. How to turn a study into code that runs — and why that changed how I learn.
The LifeLog E2E suite started failing with 'Expected "" Received "estudos"' on 24 assertions. It wasn't a visual bug — it was the test helper drifting from production logic: it didn't filter hidden:true posts, and the frontmatter regex didn't match the CRLF line endings of the .mdx files. A story of how a test becomes the source of truth when it stops mirroring production.
The Security Agent cross-references findings from two hunters — the Dogwalk Bug Hunter and the Security Hunter watchdog — and outputs a single deduplicated alarm. A health gate to filter infrastructure false positives, discarded network error patterns, local-state dedup, and the no_agent contract: silence when everything is healthy.
Arachne's vision pipeline evolved: qwen2.5vl:7b on Ollama WSL, arachne-vlm-jobs queue with arachne-vlm-w1 worker, SQLite vlm_cache.db cache (sha256), polling GET /api/extract/image-jobs/{id}. Vision requires JWT, PYTHONPATH api/ and PostgreSQL not SQLite.
ZAP, gitleaks, bandit, opengrep running across all 7 ecosystem projects. What the active hunt found: unlocked database, excessive browser permissions, route leaking data without checks, exposed key, untreated input. And the watchdog now monitoring 24/7.
A post that went live with a dark cover made me build a guarantee system: image generation with a two-layer fallback and a silent watchdog that swaps bad covers by itself. The story of how the blog stopped depending on a single path.
Local services hanging intermittently: Qdrant on port 6333, helper APIs — everything pointing to 'localhost'. On Windows, 'localhost' resolves to IPv6 (::1) first — and the connection hangs. '127.0.0.1' forces IPv4 and works. Confirmed 88 times until it became a rule: always use 127.0.0.1.
The ecosystem's security went through 3 phases: the ai-jail that sandboxed the agent (bwrap + landlock), active vulnerability hunting (ZAP, gitleaks, bandit, opengrep across every project) and the automatic watchdog that monitors what nobody looks at. 2 posts so far — and this is the full story.
Out of 78 posts, only 1 was about studies — the Ollama truncation loop. But it was in the studies that wave field theory, Mamba SSM and the BitMamba-2 1B were born. The story of what the blog's most neglected section actually produced.
TatuEngine had 5.7GB of AI models committed to git since day one. GitHub rejects objects above 2GB with a 422 error — that push would never succeed. The fix wasn't 'pushing through': it was an orphan branch that preserved code, tests, and docs and rewrote the repository's history from scratch.
The BitMamba-2 1B's 1:1 BVH took 27.26GB — unworkable. A compact ternary block codec delivered 114× compression, with the lm_head diverging mid-validation.
Arachne ran 10 services on Docker Compose. Kubernetes showed up on my resume as a desired keyword — but I didn't use it. Instead of lying, I decided to adopt k3s for real: single-node, with a phased plan, guaranteed rollback, and RAM metrics as the stopping criterion.
pnpm audit on the Portfólio screamed 61 vulnerabilities. Instead of updating dependency by dependency or trusting audit fix, I solved it with 5 lines of pnpm.overrides in package.json. Result: 61 → 2, with the remaining 2 having no published fix at all.
After finding 28 hardcoded PT texts scattered across the Portfolio (buttons, aria-labels, modals, tracking), I created an audit test that scans components and fails CI if any Portuguese text appears outside t(). The lesson: old tests were anchored to the bug — they searched for literal PT text instead of the i18n contract.
Stripe with dead DNS 500s, a Portifolio Staging that no longer existed, a rate limit that blocked the wrong IP. The surgical cleanup that made the Capivara dashboard tell the truth again — and the CF-Connecting-IP that actually fixed the rate limit.
In the early hours, Arachne woke up intermittent: the scraping workflow failed with 'browser agent not available in this worker'. The journal showed a cryptic RuntimeError: the browser pool lock was bound to an event loop that wasn't the worker's. The cause: asyncio.Lock() created at import time. The fix: lazy init — born inside the right loop.
TatuEngine got a punishment layer v3: progressive fines for repeat offenses, partial cold restart, automatic tool denial and output reprimand. The idea: instead of only rewarding good behavior, punish bad behavior with growing intensity — like an immune system that learns from every mistake.
The Capivara Dashboard had 994 lines and was impossible to maintain. Refactored to 262 (-74%), the initial bundle dropped from 668 kB to 238 kB (-64%) with React Router + lazy loading. The lesson: a giant component isn't a feature — it's disguised technical debt.
Arachne responded 200, but authenticated routes rendered empty. A Bug Hunter found 1,239 QueuePool errors in the journal since 02:57. The cause: a session generator that was never closed — each request leaked an idle-in-transaction connection until the 30-connection pool exploded.
All Dogwalk WebSockets returned HTTP 500 on handshake. The app ran, the database responded, but real-time login, chat and walk tracking simply wouldn't connect. The cause: a receive_text() called without the accept() Starlette requires.
Five days trying to make a circle of light start exactly where the finger touches. The CSS looked right, CI passed, but the user saw stutter, wrong origin, and content wiping out. The root cause wasn't the code — it was the interaction between the View Transitions API, Chromium blend modes, and a ghost node_modules.
Portfolio was 100% functional, 218 tests passing, zero CI errors. But mobile Chrome users saw old versions when restoring tabs. The cause: Chrome's bfcache ignores HTTP headers — and the fix came cross-project from LifeLog.
Automating narrative posts seemed simple: a cron, a script, a preview. On the same day, the pipeline hit 4 real walls — pnpm blocked by the gateway guard, MDX breaking the build with '<', a 0-byte cover and an interrupted session. Each wall became a rule.
After learning to infer (252× GPU speedup), TatuEngine went for the Master-Apprentice cycle: a Qwen2.5-3B teacher with LoRA distilling structured reasoning ([THOUGHT]/[ANSWER]) into the BitMamba-2 1B student. Six versions in one day (v0.17→v0.22.2), 381 examples, and the convergence that wouldn't come until the system message fix.
Nobody touched the code, yet Vercel kept rejecting the build: ERR_PNPM_EEXIST. The cause: a security cron ran pnpm audit fix with the Windows pnpm, regenerated a v10 lockfile while packageManager declared 9.12.3 — the saga of aligning local pnpm, packageManager and CI.
The personal hub was returning intermittent 502s on the tunnel. The fix: mirror Capivara to the backup machine (fallback) with one-way sync and healthcheck — and prove it with a real failover test: The primary node's cloudflared stopped for 40s, site 5/5 = 200, the backup machine took over by itself.
MCP became the universal connector (published on the official registry), FTS5+vector became hybrid search with RRF, ai-jail isolated the agent and Ollama brought AI home — and the lessons became rules: docs first, plan first, stop and ask.
Born from the absurd question 'what if we used RT Cores to process neural networks?', killed the dream on WSL2, and became a hybrid CPU/GPU engine with BitMamba-2 1B, radical compression, an agent with 8 subsystems and a security sandbox — 302 commits later.
529 commits, 218 tests, 5 mini-games, multi-layer parallax scene, interactive terminal with 15+ commands, full PT/EN i18n — the journey of a portfolio that became an interactive showcase.
107 commits, 131 backend tests + 248 frontend, 2FA TOTP, local RAG with ChromaDB, R2 backup and D1 disaster recovery — the saga of turning a personal dashboard into reliable infrastructure.
158 commits, 50 bilingual posts, 4 theme engines, 59 AI covers, and a decision that changed everything: killing the bot that wrote posts on its own.
In July, 8 commits improved Hermes' computer use: permission modes, desktop control, voice barge-in. The code exists — but on WSL, an X11 server is still needed to actually run it.
298 commits, zero new features in 30 days, and an SSM inference engine that runs unsupervised. The TatuEngine doesn't need changes — it just works.
When your engine runs AI-generated code, you need a sandbox that doesn't hinder development but won't let path traversal slip through.
July 2026 was the month my portfolio stopped getting new features and started fixing the ones it already had. A deep audit revealed 10 problems — from Pix to focus trap — and by the end, deployment was more automated than ever.
Hermes kept entering a continuation loop 4 times before giving up. The cause: Ollama, by default, only allocates 4096 context tokens — regardless of the model supporting 262K. The hard way: num_ctx of the model ≠ num_ctx of the inference slot.
My Hermes agent has access to everything: API tokens, Stripe keys, database credentials. One wrong terminal() command and it all leaks. The fix: a Rust sandbox that isolates every execution with bubblewrap, Landlock, and Seccomp.
I added Pix to my portfolio with BR Code generation. Only the QR Code didn't work in any banking app. The culprit: String.fromCharCode generating control characters instead of decimal digits in EMV 2022 length fields.
Under the hood of an 83% frontend refactoring: Ghost Components, silent schema drift, the two-systemd war, the phantom Umami proxy, and other pains that don't fit in a changelog.
Exploring the current state of TatuEngine — lessons, challenges, and discoveries.
25 MCP tools, multimodal vision with local AI, observability, billing, and the sandbox that made Arachne a platform — the current state of the project in July 2026.
From 3 projects in June to 5 in July, the Samuel ecosystem now has 2,396 commits, 3,647+ tests, and one agent orchestrating it all.
Exploring the portfolio games — lessons learned, challenges and discoveries.
The saga of making Student BitMamba-1B learn without exploding: Adafactor vs AdamW, saving 4 GB of VRAM, and the 4 bugs that produced NaN during bf16 training.
Exploring hybrid search — lessons, challenges, and discoveries.
Exploring July's tools — lessons, challenges, and discoveries.
The journey (and the craters) of training a Mamba-2 with 1.4B parameters from scratch on an RTX 3060 — warmup, SFT, catastrophic eval, and Phase 4 of the resurrection.
Exploring D1 sync — learnings, challenges and discoveries.
From zero tests to 853: how Playwright tests became the quality backbone of Dogwalk/PataPass, what we learned and what changed in the process.
Exploring the beginnings of TatuEngine — lessons, challenges, and discoveries.
From messy spreadsheets to a full dashboard with real-time health checks, Umami integration, and financial analytics with spending categories. The evolution of Capivara from a simple personal hub to the ecosystem's control center.
How end-to-end tests transformed quality and confidence in Dogwalk's development — the real story of a stack that learned to test itself.
The architecture that actually solves web data extraction: Trafilatura, Crawl4AI SDK, Docker Sidecar, and Camoufox — how each layer works, the fallback criteria, and what I learned along the way.
With 3 projects running, the infrastructure needed to be robust. Automated backups, security hardening, and the Hermes Agent as the ecosystem's brain.
After the idea came the hardest part: getting your hands dirty. How I chose React, Vite and FastAPI to build Dogwalk.
After weeks of coding, it was time to put Dogwalk online. The first deploy was a mix of euphoria and frustration — Vite + Cloudflare Pages.
